]> git.baikalelectronics.ru Git - kernel.git/commit
target: Fix REPORT TARGET PORT GROUPS handling with small allocation length
authorNicholas Bellinger <nab@linux-iscsi.org>
Wed, 19 Oct 2011 06:48:04 +0000 (23:48 -0700)
committerNicholas Bellinger <nab@linux-iscsi.org>
Mon, 24 Oct 2011 03:21:19 +0000 (03:21 +0000)
commit622027534e45e160e34213399e654f2eb46aa611
tree468f2d3ed5583cf31c3718dd5c15902676e527c7
parentd59601177b888f0017a76e97fef548d87b51e9e8
target: Fix REPORT TARGET PORT GROUPS handling with small allocation length

This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS
containing a smaller allocation length than the payload requires causing
memory writes beyond the end of the buffer.  This patch checks for the
minimum 4 byte length for the response payload length, and also checks
upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target
port group and Target port descriptor list is able to fit into the
remaining allocation length.

If the response payload exceeds the allocation length length, then rd_len
is still increments to indicate to the initiator that the payload has
been truncated.

Reported-by: Roland Dreier <roland@purestorage.com>
Cc: stable@kernel.org
Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>
drivers/target/target_core_alua.c